What is The Barracuda/CudaMail Outlook Plug-in & How Do I Use It To Reduce The Level of SPAM I Get?

Do you want to educate the CudaMail system so it understands better what kind of e-mail you want to get and what you consider as spam?

Do you want to have a very easy way to submit SPAM and false positive reports?

Do you want an easy way to keep your white list up to date?

If you answered YES to any of the above questions then you may want to try the Outlook Plug-in.

Getting to Know The Outlook Plug-In:

This very simple toolbar can be installed in the Outlook 2000 to 2007 e-mail client (not Outlook Express or the new MS Mail) to give you some additional options and two new buttons. These Green and Red buttons with an envelope and either a Check Mark (good) or Red X (bad) make the process of sending a report back to the system that you consider a message SPAM or Wanted as easy as clicking on the corresponding button. It can't get any simpler than that!

To download the toolbar simply go to the CudaMail Web Portal and click on the 'Get Mail Client Plugins Here' link at the bottom of the page. (this download link is only for current CudaMail customers - if you have a Barracuda Spam Firewall and want the plug-in go talk to your network administrator)

Per-user Web portal is at https://web.CudaMail.com

Once you download the Outlook Plug-in you have to run it to install it so you need to do this with an account that has administrative access to your PC. After it is installed you should be able to get to the 'Spam Firewall' tab under the 'Tools' - 'Options' menu item and it should look something like this:

What Does This All Mean?

Automatically Update White list: When this option is checked off every time you add someone as a new personal contact or e-mail someone then they will be added to your personal white list. While this sounds like a great idea you need to login to your personal options area on the CudaMail system on a semi-regular basis to clear out old or stale white list entries and specifically to make sure your own e-mail address is not on the white list.

A typical spammer trick is to send you spam pretending to be you so you do not want to white list your own e-mail address or you will get more spam.

This can happen by accident if you 'reply all' to an e-mail and don't take your e-mail address off or if you are in the habit of always cc'ing yourself.

Additional Button Actions:

Spam: Permanently Delete Message or Move to Deleted Items folder.

While I like to completely get rid of any spam messages by leaving it on the 'Permanently Delete Items' option you have no way of easily getting back any message you accidently marked as Spam. By setting this option to "Move to - Deleted Items Folder' you can always rescue it from there if you have an accident.

Not Spam: Add E-Mail addresses to Whitelist. When a message come through with the subject tagged as spam '[CudaMailTagged] -original subject' and you click on the Green button to submit a 'falsely marked as spam' report this option will also update your personal whitelist so that this senders e-mail will not be tagged in the future.

There is a second benefit to the plug-in as it is building your own personal database of 'Good' and 'Bad' messages that are unique to you. Once you have marked at least 200 messages of each type then the statistical analysis or 'Barracuda Bayesian Learning' will kick in and provide additional protection against Spam. You will only be able to mark messages that have been processed by the CudaMail system so don't just select everything in your inbox and try to mark them all as 'good'. What you should do is look at the message and ask yourself 'Did this e-mail come from outside our organization and is it a representative sample of e-mail that I want to get in the future?'

This plug-in is also the answer to questions like the following:

1. How do I automatically whitelist all of my contacts?
2. I get so few messages in the per-user quarantine how am I ever going to get 200 'good' messages?
3. How do I send you samples of spam that I don't want?

Does the Outlook plug-in work with Microsoft Vista?

Yes the Outlook Plug-in versions 2.1.0.5 and above work with Microsoft Vista and Outlook 2007. The plug-in version can be found on the licensing screen when installing the plug-in, or in Microsoft Outlook by viewing the Spam Firewall tab in the Options window. The version number will be located in the bottom-right corner of the window.

If you can give the Outlook Plug-in a try. I have been using it myself for the last 2 years and I get a sense of joy every time I can click on the 'Spam' button because I know that this is making the Spammer's job that much harder next time.

- Shaun

Help - Someone Has Stolen My E-mail Identity!

(... or how to publish a Sender Policy Framework (SPF) record and minimize "Joe-Job" e-mail attacks.)

>> This article assumes that you have your own domain and are not using a generic e-mail address

Has this happened to you?

You get a nice but cryptic message from someone called 'Postmaster' saying that the e-mail you sent to someone you don't know has not been delivered because you are sending SPAM! You know you did not send anything to this e-mail address so it looks like someone has hacked your e-mail account or is impersonating you to send Spam. You don't want this as they are treading on your reputation and may get you blacklisted so you can't send legitimate e-mail. It can also slow down your e-mail as your mail server has to deal with all these postmaster messages. One client of ours, for example, was getting over 1.8 million of these a day!

What can you do?

While it is very possible that they have hacked into your e-mail account* and are really using your account to send Spam it is much more likely that all the spammer has done is taken your e-mail address and used it as the 'return address' on all the spam they are sending. This is called a "Joe-Job" and the end result is that any e-mail that gets rejected for any reason will end up sending you a Non-Delivery Report (NDR) that will clog up your mailbox.

(Don't get me started on mis-configured mail servers that don't reject at the protocol level... that is something for another day ... )

So what can you do? Publish your Sender Policy Framework (SPF) record.

What is an SPF record?

Basically you get to set and publish a policy stating what mail server your e-mail should come from and what policy you want the administrators of all the other mail servers out there to take when an e-mail 'claiming' to be from you fails your policy. This is a simple record that you publish in the DNS (Domain Name) Servers that are responsible for answering the other questions people have about your domain such as where is your website and where should they send e-mail so that it gets to you.

What does an SPF record look like?

Here is the SPF record for the domain CudaMail.com:

"v=spf1 mx a:mx1.cudamail.com a:mx2.cudamail.com a:mx3.cudamail.com include:optrics.net -all"

'v=spf1' means this is an SPF record version 1 and is required.

'mx' means to allow e-mail from the systems that are already in your MX records.

'a:mx1.cudamail.com a:mx2.cudamail.com a:mx3.cudamail.com' are all the same and say to allow e-mail from the IP addresses that resolve or reverse DNS to these names - you could also use the IP address here.

'include:optrics.net' means to lookup the SPF record of the domain Optrics.net and also allow the mail servers listed there. This is used when you have to send through your ISP's mail servers - just include their SPF record. This is a great way to distribute the management of the SPF records because any e-mail from Optrics.net must be able to pass their SPF record so if you have to send through their mail servers by including their SPF so will yours.

"-all' this is where you set the policy for 'all other' mail servers. In this case the minus sign says to reject all e-mail claiming to be from your domain that does not come from the list of allowed mail servers. If you use a tilde '~' instead then you're telling the other mail administrators that you're not 100% sure that e-mail should only come from this list and they can choose to reject or not.

Great! So how do you go about setting up and publishing one of these SPF records?

The place to start is at www.openspf.org where a simple wizard will walk you through some questions and then present you with an SPF record ready to be published in the common DNS servers. If you have a control panel that allows you to make changes to your DNS records then you can make them yourself but if not you can forward the SPF record that OpenSPF generates for you to your ISP. In either case you will want to get someone to double check the SPF record before publishing it just in case you forgot something. Your ISP should know about SPF records and can provide you with guidance.

What should I watch out for?

There is a list of common mistakes on the OpenSPF website (www.openspf.org/FAQ/Common_mistakes) you will want to review but here is my own short list.

1. Watch out for your web forms that send e-mail. These have to be configured to send through your mail server and not to send directly out to other mail servers or the messages will fail the SPF check for your domain.

2. Similar to the above - any website that has a 'send this article to a friend' button typically has a place for you to put in your e-mail address so they can impersonate you when the message goes to your friend. While this sounds like a good idea it will also fail the SPF check for your domain so don't expect it to go through.

3. Blackberries. This used to be a problem with the older BlackBerry Internet Service (BIS) but now they have implemented a Sender Rewriting Scheme (SRS) so it shouldn't be a problem but you will want to test for messages being rejected when you send from your Black Berry. If they are, you can use an 'include:srs.bis.na.blackberry.com' in your SPF records assuming you are in North America.

4. Hotels and WiFi hotspots. Some hotels and WiFi providers run a transparent proxy service that intercepts all e-mail so they can either scan it for virus or to make sure they bill you for the service. These transparent proxies make it look like you are talking to your mail server but they are really doing a store and forward e-mail delivery on you and thus your e-mail looks like it is coming from the mail server of the hotel or WiFi hotspot. These messages will fail your SPF policy. You can either send e-mail via a web mail interface or see item 5 below for another solution.

5. Other SMTP servers. Some ISP's are blocking the standard SMTP port number (25), which is the default for most e-mail clients and are forcing you to use their servers. Either add their SPF record to yours as an include if this is your ISP or setup your e-mail server and client to allow you to talk to your server on an alternative authenticated SMTP port. Most mail servers are starting to support a second SMTP port and requiring that the client be authenticated before allowing them to send e-mail. Check to see if your mail server supports this alternate SMTP port feature and you will be able to take your laptop anywhere and still send e-mail.

5. Testing. There are a number of excellent third party tools out there to test your SPF record both before and after you publish your SPF record. Here is a short list:

Decludes SPF test - Can test before you go live and double check after.

> http://tools.declude.com/

DNS Stuff - Used to be 100% free but have recently gone to a paid service with some basic tests still free but you can sign up for a 21 day eval. Well worth the money but only if you work with DNS a lot. It presents the results in an easy to read format with good explanations.

> http://www.dnsstuff.com/

Scott Kitterman's SPF test site - A simple site but it gets the job done.

> http://www.kitterman.com/spf/validate.html

While this post is a little longer than usual taking the time to read it and then implementing an SPF record will be a great step in the right direction to stop these "Joe-Job" attacks on your domain. The second step is to make sure your mail server or anti-spam service is checking for SPF records. That will be the next article.

- Shaun Sturby
CudaMail's Technical Services Manager


* If they really have hacked into your e-mail account you need to change your e-mail password right now being sure to use a strong password, set your client to use encryption if possible, scan your PC for malware like keystroke loggers and if found clean these up before resetting your password to a different one again - seriously!

**If you have an e-mail address @Hotmail.com or @Yahoo.com or any other common domain then they are responsible for publishing the SPF record and have probably already done so.

Storm Worm encore just in time for Valentines day

A classic example of why the storm worm has been so successful. The subject lines of this variation play on peoples emotions and their desire to be wanted / loved. This will be successful again as valentines day comes around and people expect to get electronic valentines.

People have resist the urge to click on something like this that tugs on their heart strings.

Storm Worm encore. A Trojan repackaged yet again. This incarnation of the "Dorf" Trojan sends out emails posing as messages of love in an attempt to lure unsuspecting users to dangerous websites. The emails sport subject lines such as "Falling In Love with You," "Special Romance," and "You're In My Thoughts." The body of the email contains a link to a website that is actually one of the many compromised computers in the worldwide Storm botnet. The website displays a large red heart, while installing malware onto the visitor's computer.
More information:

http://www.sophos.com/pressoffice/news/articles/2008/01/love-storm.html

- Shaun Sturby
Technical Services Manager
CudaMail.com

3.8 Viruses on the Decline - Social Networks the Next Target

AVG Research has released an interesting report on the changing malware landscape. According to AVG, viruses now account for less than 15% of total threats, with phishing scams, backdoor worms, Trojans, keyloggers, spyware, adware and web-based exploits making up the rest.

For 2008 AVG predicts an increase in the number of web attacks on legitimate web sites, particularly social network sites, in order to use these sites for the illegal capture of user data and for the propagation of malware. Folks, over the last year I have been advising you to run your browser in a sandbox or with reduced rights. This is one of the reasons why. In the future you may not be able to assume that those "trusted" websites you visit have not been temporarily compromised.

http://www.avg.com.au/index.cfm?section=news&feature=83

- Shaun

Why Is My E-Mail Being Blocked as SPAM? I'm Not a Spammer!

(really I'm not!)

1. Maybe because you misspelled something or are using text messaging shorthand, L337 (leet) speak or hacker jargon.

http://en.wikipedia.org/wiki/Text_messaging
http://en.wikipedia.org/wiki/L337

Anti-spam filters get suspicious when they see bad spelling or unusual characters inserted into words because this is what Spammers do all the time. Don't act like a Spammer and you won't get lumped in with them. ;-)

2. If you are at your corporate site you probably send e-mail out via your organization's mail server but when you work from home, at a hotel or at your favorite coffee spot they are probably either blocking outbound SMTP traffic to stop infected systems from sending Spam or are silently proxying port 25 'in your best interest'. This can cause your outbound e-mail to fail completely or fail something called an Sender Policy Framework (SPF) check or a domain check as an outgoing server whose name doesn't match your domain name raises a red flag, unless it's a well-known one, like Gmail or Yahoo.
 
What can you do about this?
 
A. Use webmail. Since you are connecting back to your real mail server the e-mail will not be blocked and it will be coming from your mail server so the mail server checks will pass. Make sure you use a secure connection (httpS) when you do this or the hotel or coffee shop may be able to read your e-mail. Not something to do if your working on your "super secret" plan!

B. Use a VPN to your office first then use your regular mail client. Again the e-mail is going from your laptop to your mail server first so you will pass these anti-spam checks. Some locations, like hotels, may not let you start a VPN connection so you will have to use webmail or the final solution - alternate SMTP port.

C. Use an alternate port for SMTP. Way back when the Internet was young and shiny and spammers weren't born things were a lot more permissive and so requiring people to identify themselves to send e-mail wasn't necessary. Today the best thing to do is run two SMTP services or e-mail server software that can listen for e-mail on more than one port. Leave port 25 to accept e-mail from the wild and do all your anti-spam checks on this port. The second port is going to be dedicated to accepting e-mail from your users only and therefore two things are needed:

1. An alternate port like 465 or 587 mapped through your firewall to your mail server.
2. A setting that forces your users to authenticate (provide a user name and password) FIRST before accepting e-mail from them.

This way your laptop connects to your mail server on a port that is not blocked and spammers can't use this port to send you spam because they don't have a username and password on your server - simple!
 
More about SPF records next week.

Shaun Sturby
Technical Services Manager
CudaMail

Spam and Love Notes

As Valentines day draws ever closer the flood of e-mail's designed to trick you (Classic Social Engineering) into clicking on a link that will infect and take over your computer start coming fast and furious.

Here is a write-up on the latest variation of the Spam Worm (should we change it's name to the Love Worm? that uses such subject lines as:

"Valentines Day"
"Sweetest things Aren't things!"

and my personal favorite ...

"The Love Train"

http://isc.sans.org/diary.html?storyid=3979

The Storm worm continues to be a menace to all of us who spend any time on the Internet so practice safe surfing habits.

Top Ten Cyber Security Menaces for 2008

Browser vulnerabilities and botnets head threat list.

SANS has released the full article on their website:

Twelve cyber security veterans, with significant knowledge about emerging attack patterns, worked together to compile a list of the attacks most likely to cause substantial damage during 2008.

Participants included Stephen Northcutt, Ed Skoudis, Marc Sachs, Johannes Ullrich, Tom Liston, Eric Cole, Eugene Schultz, Rohit Dhamankar, Amit Yoran, Howard Schmidt, Will Pelgrin, and Alan Paller.

Here's their consensus list in ranked order:

Sans.Org 2008 Menaces

The Register links to the same information:

http://www.theregister.co.uk/2008/01/14/sans_threat_list/

- Shaun

How Can I Filter This?

There are 1,300,925,111,156,286,160,896 ways to spell Viagra!

Rob did the math on how many variations you could easily come up with and the above number is what he came up with.

http://cockeyed.com/lessons/viagra/viagra.html

Going after the word is not the way to target the spam.

This came off the Declude forums where someone is trying to come up with all the possible combinations of Viagra.

You can see why the anti-spam people went looking for a better solution.

- Shaun

Welcome To Our New Blog!

We're excited to announce the creation of our new blog on this topic and it's related news. CudaMail Anti-Spam discussion, news, and a lot of techniques and tips that will be of interest to those in the IT community who are part of the fight against spam.